11859571822

Committed 15 Nov 2024 04:08PM UTC coverage: 89.506% (+0.08%) from 89.429%

Build # 11859571822

Build Type

push

github

Committed by

web-flow

Commit Message

Add Blob Encryption (#2130)

Run Details

2731 of 3394 branches covered (80.47%)

Branch coverage included in aggregate %.

32 of 33 new or added lines in 2 files covered. (96.97%)

1 existing line in 1 file now uncovered.

9133 of 9861 relevant lines covered (92.62%)

426.4 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

93.33

/src/datasources/accounts/encryption/aws-encryption-api.service.ts

import { IConfigurationService } from '@/config/configuration.service.interface';
import { EncryptedBlob } from '@/datasources/accounts/encryption/entities/encrypted-blob.entity';
import type { IEncryptionApi } from '@/domain/interfaces/encryption-api.interface';
import {
  DecryptCommand,
  EncryptCommand,
  GenerateDataKeyCommand,
  KMSClient,
} from '@aws-sdk/client-kms';
import { Inject, Injectable } from '@nestjs/common';
import * as crypto from 'crypto';

@Injectable()
export class AwsEncryptionApiService implements IEncryptionApi {
  private readonly kmsClient: KMSClient;
  private readonly awsKmsKeyId: string | undefined;
  private readonly algorithm: string;

  constructor(
    @Inject(IConfigurationService)
    private readonly configurationService: IConfigurationService,
  ) {
    this.awsKmsKeyId = this.configurationService.get<string>(
      'accounts.encryption.awsKms.keyId',
    );
    this.algorithm = this.configurationService.getOrThrow<string>(
      'accounts.encryption.awsKms.algorithm',
    );
    this.kmsClient = new KMSClient({});
  }

  async encrypt(data: string): Promise<string> {
    const encryptedData = await this.kmsClient.send(
      new EncryptCommand({
        KeyId: this.awsKmsKeyId,
        Plaintext: Buffer.from(data),
      }),
    );
    if (!encryptedData.CiphertextBlob) {
      throw new Error('Failed to encrypt data');
    }
    return Buffer.from(encryptedData.CiphertextBlob).toString('base64');
  }

  async decrypt(data: string): Promise<string> {
    const decryptedData = await this.kmsClient.send(
      new DecryptCommand({ CiphertextBlob: Buffer.from(data, 'base64') }),
    );
    if (!decryptedData.Plaintext) {
      throw new Error('Failed to decrypt data');
    }
    return Buffer.from(decryptedData.Plaintext).toString('utf8');
  }

  async encryptBlob(data: unknown): Promise<EncryptedBlob> {
    if ((typeof data !== 'object' && !Array.isArray(data)) || data === null) {
      throw new Error('Data must be an object or array');
    }
    const { Plaintext, CiphertextBlob } = await this.kmsClient.send(
      new GenerateDataKeyCommand({
        KeyId: this.awsKmsKeyId,
        KeySpec: 'AES_256',
      }),
    );
    if (!Plaintext || !CiphertextBlob) {
      throw new Error('Failed to generate data key');
    }
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv(this.algorithm, Plaintext, iv);
    return {
      encryptedData: Buffer.concat([
        cipher.update(JSON.stringify(data), 'utf8'),
        cipher.final(),
      ]),
      encryptedDataKey: Buffer.from(CiphertextBlob),
      iv,
    };
  }

  async decryptBlob(encryptedBlob: EncryptedBlob): Promise<unknown> {
    const { encryptedData, encryptedDataKey, iv } = encryptedBlob;
    const { Plaintext } = await this.kmsClient.send(
      new DecryptCommand({ CiphertextBlob: encryptedDataKey }),
    );
    if (!Plaintext) {
      throw new Error('Failed to decrypt data key');
    }
    const decipher = crypto.createDecipheriv(this.algorithm, Plaintext, iv);
    const decryptedData = Buffer.concat([
      decipher.update(encryptedData),
      decipher.final(),
    ]);
    return JSON.parse(decryptedData.toString('utf8'));
  }
}

1	import { IConfigurationService } from '@/config/configuration.service.interface';	112✔
2	import { EncryptedBlob } from '@/datasources/accounts/encryption/entities/encrypted-blob.entity';
3	import type { IEncryptionApi } from '@/domain/interfaces/encryption-api.interface';
4	import {	112✔
5	DecryptCommand,
6	EncryptCommand,
7	GenerateDataKeyCommand,
8	KMSClient,
9	} from '@aws-sdk/client-kms';
10	import { Inject, Injectable } from '@nestjs/common';	112✔
11	import * as crypto from 'crypto';	112✔
12
13	@Injectable()
14	export class AwsEncryptionApiService implements IEncryptionApi {	112✔
15	private readonly kmsClient: KMSClient;
16	private readonly awsKmsKeyId: string \| undefined;
17	private readonly algorithm: string;
18
19	constructor(
20	@Inject(IConfigurationService)
21	private readonly configurationService: IConfigurationService,	30✔
22	) {
23	this.awsKmsKeyId = this.configurationService.get<string>(	30✔
24	'accounts.encryption.awsKms.keyId',
25	);
26	this.algorithm = this.configurationService.getOrThrow<string>(	30✔
27	'accounts.encryption.awsKms.algorithm',
28	);
29	this.kmsClient = new KMSClient({});	30✔
30	}
31
32	async encrypt(data: string): Promise<string> {
33	const encryptedData = await this.kmsClient.send(	6✔
34	new EncryptCommand({
35	KeyId: this.awsKmsKeyId,
36	Plaintext: Buffer.from(data),
37	}),
38	);
39	if (!encryptedData.CiphertextBlob) {	4✔
40	throw new Error('Failed to encrypt data');	2✔
41	}
42	return Buffer.from(encryptedData.CiphertextBlob).toString('base64');	2✔
43	}
44
45	async decrypt(data: string): Promise<string> {
46	const decryptedData = await this.kmsClient.send(	6✔
47	new DecryptCommand({ CiphertextBlob: Buffer.from(data, 'base64') }),
48	);
49	if (!decryptedData.Plaintext) {	4✔
50	throw new Error('Failed to decrypt data');	2✔
51	}
52	return Buffer.from(decryptedData.Plaintext).toString('utf8');	2✔
53	}
54
55	async encryptBlob(data: unknown): Promise<EncryptedBlob> {
56	if ((typeof data !== 'object' && !Array.isArray(data)) \|\| data === null) {	14✔
57	throw new Error('Data must be an object or array');	6✔
58	}
59	const { Plaintext, CiphertextBlob } = await this.kmsClient.send(	8✔
60	new GenerateDataKeyCommand({
61	KeyId: this.awsKmsKeyId,
62	KeySpec: 'AES_256',
63	}),
64	);
65	if (!Plaintext \|\| !CiphertextBlob) {	6✔
66	throw new Error('Failed to generate data key');	4✔
67	}
68	const iv = crypto.randomBytes(16);	2✔
69	const cipher = crypto.createCipheriv(this.algorithm, Plaintext, iv);	2✔
70	return {	2✔
71	encryptedData: Buffer.concat([
72	cipher.update(JSON.stringify(data), 'utf8'),
73	cipher.final(),
74	]),
75	encryptedDataKey: Buffer.from(CiphertextBlob),
76	iv,
77	};
78	}
79
80	async decryptBlob(encryptedBlob: EncryptedBlob): Promise<unknown> {
81	const { encryptedData, encryptedDataKey, iv } = encryptedBlob;	4✔
82	const { Plaintext } = await this.kmsClient.send(	4✔
83	new DecryptCommand({ CiphertextBlob: encryptedDataKey }),
84	);
85	if (!Plaintext) {	2!
NEW 86	throw new Error('Failed to decrypt data key');	×
87	}
88	const decipher = crypto.createDecipheriv(this.algorithm, Plaintext, iv);	2✔
89	const decryptedData = Buffer.concat([	2✔
90	decipher.update(encryptedData),
91	decipher.final(),
92	]);
93	return JSON.parse(decryptedData.toString('utf8'));	2✔
94	}
95	}

safe-global / safe-client-gateway / 11859571822

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous